From owner-freebsd-pf@FreeBSD.ORG Sun Aug 13 02:23:06 2006 Return-Path: X-Original-To: freebsd-pf@freebsd.org Delivered-To: freebsd-pf@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7D00B16A4DD for ; Sun, 13 Aug 2006 02:23:06 +0000 (UTC) (envelope-from solinym@gmail.com) Received: from py-out-1112.google.com (py-out-1112.google.com [64.233.166.178]) by mx1.FreeBSD.org (Postfix) with ESMTP id 04DC343D45 for ; Sun, 13 Aug 2006 02:23:05 +0000 (GMT) (envelope-from solinym@gmail.com) Received: by py-out-1112.google.com with SMTP id c59so528758pyc for ; Sat, 12 Aug 2006 19:23:05 -0700 (PDT) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=pnYqS7fi6VMr/fFPLJxpncRPcOJLryC7L3wOqduEjsF9wINmCn/kgdHsKj5H1NPyfQml4tCX/X9tyvtnhyP83uH2IpXaz+eeL9JGn3VGmHT1RR8o8r5k7VR7bJbwJDWsWlAG9unDFYx5e3edzmON4ZW6nvIulxRHGPny1kDOti0= Received: by 10.35.63.2 with SMTP id q2mr9751116pyk; Sat, 12 Aug 2006 19:23:04 -0700 (PDT) Received: by 10.35.34.13 with HTTP; Sat, 12 Aug 2006 19:23:04 -0700 (PDT) Message-ID: Date: Sat, 12 Aug 2006 21:23:04 -0500 From: "Travis H." To: "Bill Marquette" In-Reply-To: <55e8a96c0608120657j68242447nb247b7fa44c7ac67@mail.gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <20060812040200.F7HM8VPAHU@priv-edtnaa05.telusplanet.net> <55e8a96c0608120657j68242447nb247b7fa44c7ac67@mail.gmail.com> Cc: freebsd-pf@freebsd.org Subject: Re: firewall X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 13 Aug 2006 02:23:06 -0000 As I remember it, the only feature IPFilter had that I used that pf doesn't have was the ability to simulate throwing packets at it and see what their disposition is. I wrote a test harness to check the sanity of my firewalls, before committing them to CVS. I highly recommend switching to pf. I haven't followed ipfilter, but it's encumbered and last I checked (a _long_ time ago), it didn't have packet scrubbing or nearly 50% of the features of pf. -- "If you're not part of the solution, you're part of the precipitate." Unix "guru" for rent or hire -><- http://www.lightconsulting.com/~travis/ GPG fingerprint: 9D3F 395A DAC5 5CCC 9066 151D 0A6B 4098 0C55 1484